Project
SAML SSO - Service Provider
Date
Severity
Critical
Risk Score
19/25 AC:Basic/A:None/CI:Some/II:Some/E:Exploit/TD:All
Vulnerability
Cross Site Scripting
Affected versions
<7.x-2.75

Description

The SAML SSO Service Provider module lets a Drupal site act as a SAML service provider so that users can log in through an external identity provider.

The module reads several fields from an incoming SAML response, including the status code, the encryption algorithm, the response timestamp and the destination, and prints them into error pages at its assertion consumer endpoint without escaping them, so an attacker who submits a crafted response can have arbitrary HTML and JavaScript reflected into the browser of anyone who loads the response.

The assertion consumer endpoint is open to anonymous users and this output happens before the response signature is validated, so no valid signature and no account are required, and the vulnerability is mitigated only by the fact that the attacker must lure a victim into submitting the crafted response to the site.

Solution

Install the latest version.

If you use the SAML SSO - Service Provider module for Drupal 7, upgrade to SAML SSO - Service Provider 7.x-2.75:

Reported by

Fixed by

Coordinated by